Microsoft 70-680

TS Windows 7, Configuring

ExamForce.com 70-680 Study Guide

About the Exam

Eight major topic areas make up the Microsoft 70-680 TS: Windows 7, Configuring exam. The
number included indicates the weight of each section on the exam. For example, 14% percent of
the exams weight will be placed upon the topic of Installing, Upgrading, and Migrating to
Windows.

Installing, Upgrading, and Migrating to Windows 7 14%

Deploying Windows 7 13%
Configuring Hardware and Applications 14%
Configuring Network Connectivity 14%
Configuring Access to Resources 13%
Configuring Mobile Computing 10%
Monitoring and Maintaining Systems that Run Windows 7 11%
Configuring Backup and Recovery Options 11%

This guide will walk you through all the skills measured by the exam, as published by Microsoft.

ExamForce.com 70-680 Study Guide

Objectives
Chapter 1: Installing, Upgrading, and Migrating to Windows 7
Perform a clean installation.
This objective may include but is not limited to: identifying hardware
requirements; setting up as the sole operating system; setting up as dual boot;
installation methods; boot from the source of installation, preparing the
installation source: USB, CD, network share, WDS
Upgrade to Windows 7 from previous versions of Windows.
This objective may include but is not limited to: upgrading from Windows
Vista; migrating from Windows XP; upgrading from one edition of Windows
7 to another edition of Windows 7
Migrate user profiles.
This objective may include but is not limited to: migrating from one machine
to another; migrating from previous versions of Windows; side-by-side vs.
wipe and load
Chapter 2: Deploying Windows 7
Capture a system image.
This objective may include but is not limited to: preparing system for capture;
creating a WIM file; automated capture; manual capture
Prepare a system image for deployment.
This objective may include but is not limited to: inserting an application into a
system image; inserting a driver into a system image; inserting an update into
a system image; configuring tasks to run after deployment
Deploy a system image.
This objective may include but is not limited to: automated deployment
methods; manually deploying a customized image
Configure a VHD.
This objective may include but is not limited to: creating, deploying, booting,
mounting, and updating VHDs; offline updates; offline servicing
Chapter 3: Configuring Hardware and Applications
Configure devices.
This objective may include but is not limited to: updating, disabling, and
uninstalling drivers; signed drivers; conflicts between drivers; configuring
driver settings; resolving problem device driver

ExamForce.com 70-680 Study Guide

Configure application compatibility.

This objective may include but is not limited to: setting compatibility mode;
implementing shims; compatibility issues with Internet Explorer
Configure application restrictions.
This objective may include but is not limited to: setting software restriction
policies; setting application control policies; setting through group policy or
local security policy
Configure Internet Explorer.
This objective may include but is not limited to: configuring compatibility
view; configuring security settings; configuring providers; managing add-ons;
controlling InPrivate mode; certificates for secure Web sites
Chapter 4: Configuring Network Connectivity
Configure IPv4 network settings.
This objective may include but is not limited to: connecting to a network;
configuring name resolution; setting up a connection for a network; network
locations; resolving connectivity issues; APIPA
Configure IPv6 network settings.
This objective may include but is not limited to: configuring name resolution;
connecting to a network; setting up a connection for a network; network
locations; resolving connectivity issues; link local multicast name resolution
Configure networking settings.
This objective may include but is not limited to: adding a physically
connected (wired) or wireless device; connecting to a wireless network;
configuring security settings on the client; set preferred wireless networks;
configuring network adapters; configuring location-aware printing
Configure Windows Firewall.
This objective may include but is not limited to: configuring rules for multiple
profiles; allowing or denying an application; network-profile-specific rules;
configuring notifications; configuring authenticated exceptions
Configure remote management.
This objective may include but is not limited to: remote management
methods; configuring remote management tools; executing PowerShell
commands
Chapter 5: Configuring Access to Resources
Configure shared resources.
This objective may include but is not limited to: folder virtualization; shared
folder permissions; printers and queues; configuring HomeGroup settings

ExamForce.com 70-680 Study Guide

Configure file and folder access.

This objective may include but is not limited to: encrypting files and folders
by using EFS; configuring NTFS permissions; resolving effective permissions
issues; copying files vs. moving files
Configure user account control (UAC).
This objective may include but is not limited to: configuring local security
policy; configuring admin vs. standard UAC prompt behaviors; configuring
Secure Desktop
Configure authentication and authorization.
This objective may include but is not limited to: resolving authentication
issues; configuring rights; managing credentials; managing certificates; smart
cards with PIV; elevating user privileges; multifactor authentication
Configure BranchCache.
This objective may include but is not limited to: distributed cache mode vs.
hosted mode; network infrastructure requirements; configuring settings;
certificate management
Chapter 6: Configuring Mobile Computing
Configure BitLocker and BitLocker To Go.
This objective may include but is not limited to: configuring BitLocker and
BitLocker To Go policies; managing Trusted Platform Module (TPM) PINs;
configuring startup key storage; data recovery agent support
Configure DirectAccess.
This objective may include but is not limited to: configuring client side;
configuring authentication; network infrastructure requirements
Configure mobility options.
This objective may include but is not limited to: configuring offline file
policies; transparent caching; creating and migrating power policy
Configure remote connections.
This objective may include but is not limited to: establishing VPN
connections and authentication; enabling a VPN reconnect; advanced security
auditing; NAP quarantine remediation; dial-up connections; remote desktop;
published apps
Chapter 7: Monitoring and Maintaining Systems that Run Windows 7
Configure updates to Windows 7.
This objective may include but is not limited to: configuring update settings;
determining source of updates; configuring Windows Update policies;
reviewing update history; checking for new updates; rolling back updates

ExamForce.com 70-680 Study Guide

Manage disks.
This objective may include but is not limited to: managing disk volumes;
managing file system fragmentation; RAID; removable device policies
Monitor systems.
This objective may include but is not limited to: configuring event logging;
filtering event logs; event subscriptions; data collector sets; generating a
system diagnostics report
Configure performance settings.
This objective may include but is not limited to: configuring page files;
configuring hard drive cache; updated drivers; configuring networking
performance; configuring power plans; configuring processor scheduling;
configuring desktop environment; configuring services and programs to
resolve performance issues; mobile computing performance issues;
configuring power
Chapter 8: Configuring Backup and Recovery Options
Configure backup.
This objective may include but is not limited to: creating a system recovery
disk; backing up files, folders, or full system; scheduling backups
Configure system recovery options.
This objective may include but is not limited to: configuring system restore
points; restoring system settings; last known good configuration; complete
restore; driver rollback
Configure file recovery options.
This objective may include but is not limited to: configuring file restore
points; restoring previous versions of files and folders; restoring damaged or
deleted files by using shadow copies; restore user profiles

ExamForce.com 70-680 Study Guide

Chapter 1 Installing, Upgrading, and

Migrating to Windows 7
Perform a clean installation.
Identifying hardware requirements.
The minimum hardware requirements to install Windows 7 are as follows:

Keep in mind that these are the minimum requirements for Windows 7 to work. In
reality, youll want these levels to be higher to support whatever applications you
also have installed. The 64-bit version of the Operating System supports up to the
following amount of RAM:
Home Basic Edition:
Home Premium Edition:
Professional Edition:
Enterprise/Ultimate Editions:

8 GB
16GB
128 GB or more
128 GB or more

The 32-bit version of the OS will only support a maximum of 4 GB of RAM.

Applications will only be able to access 3 GB of this memory, with the remaining
memory used for system performance.
Setting up as dual boot.
In order to set up Windows 7 to dual boot with another operating system, you must
first allocate disk space on the existing computer for the Windows 7 installation.
This can be accomplished with the Disk Management tool. If necessary, youll
have to shrink the other volumes to create at least 25 30 GB of free space. In
reality, though, youll want it to be considerably more than this for additional
functionality.

Chapter

Quick Jump To:

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

ExamForce.com 70-680 Study Guide

In the Disk Management tool, right-click some unallocated disk space, select New simple
volume, and complete the wizard. Next, do a quick format using the NTFS file system and this
parts done!
The only thing left to do is to boot the computer using the Windows 7 Installation Disk and
complete the wizard using the Custom (advanced) installation type. Youll have to point the
setup program to your newly-created partition. Windows 7 will automatically configure the
Bootloader, which will now present you with a menu option during bootup.
To modify the Bootloader to change the OS boot order, description, timeouts, etc. follow this
procedure:
1. Open a command prompt using Administrative privileges (right click on cmd.exe and
select Run as Administrator)
2. Type the command: bcdedit
3. Make a backup of the Bootloader by typing the command: bcdedit /export
PATH:\FILENAME (where PATH:\FILENAME is a valid fileshare)
4. Use the following commands to edit the Bootloader:

Installation methods.
Windows 7 supports the following installation methods:
1. Clean Installation This installation in the following scenarios:
1) No operating system currently installed
2) The current OS does not support the Windows 7 upgrade
3) The computer has multiple partitions and needs to support a multiple-boot configuration
using the current OS as well as the new Windows 7.
Performing a clean installation on a computer without an operating system requires starting
the computer directly from the CD or DVD (depending on your OS version). If you will be
replacing an existing operating system, and will be able to explore the files on the CD/DVD,
then you can execute the setup.exe file from within the existing OS. If you do not have
access to the CD/DVD, but can access it via a network file share, this is available as well.
One final option involves using a disk image to perform a clean installation. This method
utilizes the Windows Imaging (WIM) file format to install the Windows OS. With this
method, you can modify the image offline by adding or removing OS components, drivers,
files, and updates without having to create a new image.
Windows 7 uses a tool called ImageX for creating and managing WIM files.

ExamForce.com 70-680 Study Guide

2. Upgrade Installation Also called an in-place upgrade, this involves replacing an existing
version of Windows with Windows 7. Using this method, you will be able to retain all user
applications, files, and settings.
To perform an in-place upgrade, you will have to execute the setup.exe file from either the
CD/DVD or a network file share. Even though the installation process will retain all user
and hardware settings, data, applications, and other configurations, it is still important to
back up important data before performing the upgrade.
3. Migration If you already have an existing Windows 7 operating system installed on a
computer (destination computer) and want to move your files and settings from an older
operating system (source computer), you will perform a migration.
Boot from the source of installation.
Several options exist for installing Windows 7:
1. USB
2. CD/DVD
3. Network share
4. Using an Image
Preparing the installation source.
USB
As of Windows Vista and Windows 7, it is possible to install the OS from a USB storage key.

From within Windows Vista, its possible to create a bootable USB key, as long as you have the
Windows 7 bootable media to copy to the USB key. To create this bootable USB key, follow
this procedure:
1. Plug the USB key into your computer, back up any data, and format it:
a. Open a command prompt and Run as administrator. This will place you in the
c:\Windows\system32 folder
b. Type the following commands:
i. DISKPART to enter the Disk Partition command prompt.

ExamForce.com 70-680 Study Guide

ii. LIST DISK to display all partitions, including the attached USB key.
Make note of the partition number for the USB key.
iii. select disk <number of USB key>.
iv. clean
v. create partition primary
vi. select partition 1
vii. active
viii. format fs=ntfs
ix. assign
x. exit
2. Make the USB Key a Bootable Device
a. Still at the Command Prompt (running as Administrator), navigate to the folder
containing your Windows 7 installation files and type the following commands:
i. cd boot (to get into the boot directory)
ii. bootsect.exe /nt60 X: (where X: is the drive letter assigned to your USB
key)
3. Copy Install Files to the USB Key
4. Install USB Key into target computer and hit the F key to access the boot menu and
select the USB storage device from the menu.
CD/DVD
This procedure is very straightforward: just insert the CD/DVD into the optical drive and boot
the target computer, if installing on a PC with no existing OS. If installing on a PC with a nonWindows OS, access the CD/DVD via the file explorer and execute the setup.exe file.
Network share
It is possible to boot from a network share without or without an existing OS on the target
computer.
1. If the computer has an existing OS, simply access the setup.exe file by browsing to the
appropriate network file share.
2. If the computer does not have an existing OS:
a. Start the computer by using the Windows PE (Preinstallation Environment) from
either the CD/DVD, USB key, or via the Windows Deployment Services (WDS).
b. Connect to the file share containing the Windows 7 installation files.
c. Execute the setup.exe file.
d. Complete the Installation Wizard.
Installing via an Image
Windows 7 can be installed via an image, as follows:
1. Install Windows 7 to another computer that will be used as a reference and prepare that
computer to be copied.
2. Create a WIM image of the reference computer by using the ImageX tool. This tool can
be executed from a command prompt or from the Windows PE.
3. Then, use one of the following tools to deploy the new image to the target computer:
a. ImageX
b. WDS

ExamForce.com 70-680 Study Guide

10

c. Microsoft Deployment Toolkit (MDT)

Upgrade to Windows 7 from previous versions of Windows.

Upgrading from Windows Vista.
Windows 7 does not support upgrading from Windows versions earlier than Windows XP. For
these systems, a clean installation is required. There are two types of upgrades:
1. In-place upgrade Windows Vista with Service Pack 1 or later is required for this option.
Simply insert the CD/DVD, select the setup.exe file, and choose the Upgrade option
during the Installation Wizard.
2. Windows Anytime Upgrade (WAU) Allows Windows 7 to move to a more powerful
version of the same OS, and includes the DVD media, product key, and upgrade
instructions. Simply insert the CD/DVD, select the setup.exe file, and choose the
Upgrade option during the Installation Wizard.
Windows XP is not supported for a direct upgrade to Windows 7. Instead, we are able to migrate
the user state to any edition of Windows 7 (except the Starter edition).
The Windows Upgrade Advisor is a tool that can be downloaded via the Web and can be used to
identify which version of Windows 7 is best suited for your needs. It will also verify whether
your computers are capable of supporting an upgrade to Windows 7 and which features of
Windows 7 will run on your computers.
Installation of the Windows Upgrade Advisor requires the following:
1. Administrator privileges
2. .NET 2.0
3. MSXML6
4. 20 MB of free Hard Drive Space
5. Internet connectivity
Migrating from Windows XP.
Migration of the users configuration settings and data can be performed using one of the two
following tools:
1. Windows Easy Transfer (WET) Best suited for a side-by-side migration for a single
computer, or a small number of computers. This tool supports moving data to the target
computer via the network, Windows Easy Transfer cable, removable media, or a writable
CD/DVD.
2. User State Migration Tool (USMT) Best suited for a side-by-side migration for many
computers where it is ideal to automate the process as much as possible. The USMT uses a
two-stage process:
a. Stage 1: USMT captures files and settings to appropriate media
b. Stage 2: USMT restores files and settings to the target computer

ExamForce.com 70-680 Study Guide

11

Upgrading from one edition of Windows 7 to another edition of Windows 7.

Windows Anytime Upgrade (WAU) Allows Windows 7 to move to a more powerful version of
the same OS, and includes the DVD media, product key, and upgrade instructions. Simply insert
the CD/DVD, select the setup.exe file, and choose the Upgrade option during the Installation
Wizard.
Migrate user profiles.
Migrating from previous versions of Windows.
The following components are able to be moved from Windows XP to Windows 7 during the
migration:
1. User Accounts
2. Application Settings
3. Operating System Settings
4. File Types, Folders, and Settings
a. You will have to determine and locate the standard file locations on each computer
(My Documents, company-specific folders, etc).
b. For any non-standard locations, you will have to consider the following:
i. File types which file types will be included and excluded during the
migration
ii. Excluded Locations which folders will not be moved during the migration
(i.e. System folders, for example).
iii. New Locations Where will you migrate files onto the target computer?
Side-by-side vs. wipe and load
There are two migration scenarios:
1. Side-by-Side In this scenario, the source and destination computers are two
different machines.
2. Wipe and Load In this scenario, you must perform a clean installation of Windows
7 on a computer that already has an OS by running a Custom (advanced)
installation. This procedure requires the following steps:
a. Back up existing user settings and data
b. Perform a clean installation
c. Reinstall all needed applications
d. Restore user settings and data from the backup

ExamForce.com 70-680 Study Guide

12

Chapter

Chapter 2 Deploying Windows 7

Quick Jump To:

Capture a system image.

Preparing system for capture.
Preparing the system to capture the installation image requires the following three
steps:
1. Build an Answer File This file contains all settings needed during the
unattended installation. To create this answer file:
a. Click Start -> All Programs -> click the Windows Automated
Installation Kit (AIK) -> click the Windows System Image Manager
b. In the Windows Image area, right-click Select a Windows image or
catalog file and then click Select Windows Image.
c. Browse to the folder where you have the Windows 7 installation media
stored, click on the installation catalog file (extension .clg), and click
Open.
d. In the Answer File area, right-click Create or open an answer file,
and then click New Answer File.
e. In the Windows Image area, expand Components and expand
x86_Microsoft-Windows-Setup.
f. Expand UserData and right-click ProductKey.
g. Scroll down and click x86_Microsoft-Windows-Shell-Setup and
click Add setting to Pass 4 specialize.
h. In the Microsoft-Windows-Shell-Setup Properties area, in the
ProductKey box, type the appropriate installation key and press
Enter.
i. Close the Windows System Image Manager making sure to save any
changes.
2. Build a reference installation The Sysprep tool will be used to prepare the
reference computer for duplication, auditing, and end-user delivery.
Sysprep has the following configuration options:
1. /audit restarts system in audit mode and allows you to add drivers or
applications to Windows
2. /generalize prepares system to be imaged by removing all unique
system information. The security ID (SID) is reset, any system restore
points are cleared, and event logs are deleted.
3. /oobe Out of Box Experience restarts computer in Windows
Welcome mode enabling users to customize their Windows OS.
4. /reboot restarts the computer and allows the computer to be audited
and to verify that the first-run experience operates correctly.
5. /shutdown shuts computer down after Sysprep command finishes.
6. /quiet runs Sysprep tool without displaying on-screen confirmation
messages.

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

ExamForce.com 70-680 Study Guide

13

7. /quit closes the Sysprep tool after running specified commands.

8. /unattend:answerfile applies settings in an answer file to Windows during
unattended installation.
3. Create a bootable Windows PE Media
a. Click Start -> All Programs -> Microsoft Windows AIK -> Deployment Tools
Command Prompt.
b. At the command prompt, type: copype.cmd <arch> <destination>, where
<arch> can be x86, amd64, or ia64, depending on the processor type. The
destination will be a path to a local directory.
i. Example: copype.cmd ia64 e:\winpe_ia64
c. At the command prompt, type copy C:\Program Files\Windows
AIK\Tools\ia64\imagex.exe E:\winpe_ia64\iso (where C: is the root drive and you
have an Intel 64-bit CPU installed)
d. At the command prompt, type oscdimg n bE:\winpe_ia64\etfsboot.com
E:\winpe_ia64\iso E:\winpe_ia64\winpe_ia64.iso (this creates the ISO file with
Windows PE)
WIM files.
A .wim file contains one or more volume/partition images that contain images of an installed
Windows operating system.
Capture Installation Image with ImageX.
ImageX is a command-line tool that enables you to capture, modify, and apply file-based WIM
images and can be used to perform the following tasks:
1. View contents of a WIM file
2. Capture and apply images
3. Mount images for offline image editing
4. Store multiple images in a single file
5. Compress the image files
6. Implement scripts for image creation
ImageX has the following command line options:
1. /flags EditionID specifies the version of Windows that will be captured
2. /dir displays a list of files and folders within a volume range
3. /info returns information about the .wim file, including total file size, image index
number, the directory count, file count, and description.
4. /capture captures a volume image from a drive to a new .wim file.
5. /apply applies a volume image to a specified drive.
6. /append adds a volume image to an existing .wim file.
7. /delete removes specified volume image from a .wim file.
8. /export exports a copy of a .wim file to another .wim file.
9. /mount mounts a .wim file with read permission.
10. /mountrw mounts a .wim file with read/write permission.
11. /unmount unmounts a mounted image from a specified directory. If you have modified a
mounted image, you must apply the /commit option to save your changes.

ExamForce.com 70-680 Study Guide

14

12. /split splits large .wim files into multiple read-only .wim files.
Prepare a system image for deployment.
The Deployment Image Servicing and Management (DISM) is a command-line tool used to
service Windows images offline before deployment. The DISM can be used to install, uninstall,
configure, and update Windows features, packages, drivers, and international settings.
Inserting an application into a system image.
To add an application to an existing system image with DISM, do the following:
1. Click on the Start -> All Programs -> Microsoft Windows AIK -> Deployment Tools
Command Prompt
2. At the command prompt, type the following commands:
Step 1: Prep/Cleanup
DISM /Cleanup-Wim cleans up any previous wims/mounts
Step 2: Copy WinPE 3.0 to your local C Drive
copype.cmd x86 c:\winpe_x86
copy c:\winpe_x86\winpe.win c:\winpe_x86\ISO\sources\boot.wim
Step 3: Mount .wim File on your local C Drive
DISM /Mount-Wim /WimFile:C:\winpe_x86\winpe.wim /index:1
/MountDir:C:\winpe_x86\mount
Step 4: Add Packages to your WIM: (example package: WMI tools)
DISM /image:C:\winpe_x86\mount /Add-Package /PackagePath:C:\Program
Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\en-us\winpe-wmi_en-us.cab
Step 5: Add Drivers to WinPE
DISM /image:c:\winpe_x86\mount /Add-Driver /driver:C:\INF_DRIVERS\ /recurse
Inserting a driver into a system image.
Same as above, except command in Step 4 would be:
a . DISM /image:C:\img /add-driver /driver:<Path to driver file>

Deploy a system image.

Automated and manual deployment methods.
After you have an image of your reference installation, you can deploy the image to the target
computer. You can use the DiskPart tool to format the hard drive, and copy the image from the
network share. Use ImageX to apply the image to the destination computer.
For high-volume deployments, you can store the image of the new installation to your
distribution share and deploy the image to destination computers by using deployment tools,
such as Windows Deployment Services (WDS) or Microsoft Deployment Toolkit (MDT).

Configure a VHD.
Creating, deploying, booting, mounting, and updating VHDs.
In Windows 7, a VHD can be used to store an operating system to run on a computer
without a parent operating system, virtual machine or hypervisor. This feature, called

ExamForce.com 70-680 Study Guide

15

VHD boot, is a new feature in Windows 7 that eases the transition between virtual and
physical environments.
The following steps outline Windows 7 deployment on VHD:
1. Create the VHD -- you can create a VHD by using the DiskPart tool or the Disk Management
MMC. The Disk Management MMC also enables you to attach the VHD, so that it appears on
the host computer as a drive and not as a static file. VHD files can then be partitioned and
formatted before you install an operating system.
2. Prepare the VHD install Windows 7 on the VHD. You can perform the capture and apply
method by using ImageX.
3. Deploy the VHD -- the VHD file can then be copied to one or more systems, to be run in
a virtual machine or for native boot. To configure native-boot, add the native-boot VHD
to the boot menu by using BCDedit or BCDboot tool. BCDedit is a command-line tool
for managing Boot Configuration Data (BCD) stores and BCDboot is a command-line
tool for initializing the BCD store and copying boot environment files to the system
partition. You can also automate the network deployment of VHD by using WDS. WDS
can be used to copy the VHD image to a local partition and to configure the local Boot
Configuration Data (BCD) for native-boot from the VHD.
Offline updates and servicing.
A virtual hard disk (VHD) with an applied Windows 7 image can be serviced offline or
serviced online with command-line tools such as Deployment Image Servicing and Management
(DISM.exe).
NOTE:

DISM operations performed on a VHD cannot be

discarded by using the /unmount option, as they can
with .wim files. It is recommended that you create a
backup copy of the .vhd file before servicing it.

Step 1: Prepare an offline VHD

1.To prepare the VHD for servicing with the DISM tool, attach the vdisk using the DiskPart
tool. For example, at a command prompt with elevated privileges, type:
diskpart
select vdisk file=c:\windows7.vhd
attach vdisk
assign letter=r
(Note: The VHD appears as the lettered drive R:\ on the computer)
exit
Step 2: Service the VHD using DISM Use the DISM tool to modify or service the Windows
image entirely offline.
1. Open an elevated command prompt. Click Start, click All Programs, click Accessories,
right-click Command Prompt, select Run as administrator.
2. Navigate to the DISM tool.
From this point, several things can be done to the VHD image, such as:

ExamForce.com 70-680 Study Guide

16

1. Add drivers At the command prompt, type the following command to add a specific driver
to the image:
Example: Dism /image:R:\ /Add-Driver /driver:C:\drivers\mydriver.INF
2. Remove drivers Multiple drivers can be removed on one command line using the /RemoveDriver and /driver options. For example, at the command prompt, type:
Example: Dism /image:R:\/Remove-Driver /driver:OEM1.inf /driver:OEM2.inf
3. Add a package or language pack You can add multiple packages on one command line
using the /Add-Package and /PackagePath options. For example, at the command prompt, type:
Example: Dism /image:R:\ /Add-Package /PackagePath:C:\packages\package1.cab
/PackagePath:C:\packages\package2.cab
4. Remove a package or language pack You can remove multiple .cab files using one
command-line statement, using the /Remove-Package and /PackagePath options. For example, at
the command prompt, type:
Example: Dism /image:R:\ /Remove-Package /PackagePath:C:\packages\package1.cab
/PackagePath:C:\packages\package2.cab

ExamForce.com 70-680 Study Guide

17

Chapter 3 Configuring Hardware and

Applications
Configure devices.
Updating, disabling, and uninstalling drivers.
Windows 7 includes the following options for updating device drivers:
1. Dynamic Update This tool works with Windows Update to download
critical fixes and device drivers required for the setup process. It downloads
the following types of files:
a. Critical updates
b. Device drivers
2. Windows Update Delivers software updates and drivers, and provides
options for both manually and automatically updating the OS from within the
OS.

Chapter

Quick Jump To:

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

3. Manufacturers media or Web site While Microsoft recommends that you

first check Windows Update for the correct drivers, you can also go directly to
the manufacturers web site to download any latest drivers.
4. Device Manager Provides a means for manually updating driver software
from within the OS. To manually update a device driver.
a. Open the device manager by clicking Start and typing device
manager, which will display the tool. Click on the Device Manager
tool.
b. Double-click the type of device you want to update.
c. Right-click the device and click Update Driver Software.
d. Follow instructions in the Update Driver Software wizard.
5. Compatibility Report When performing an upgrade to the OS, this report
will allow you to update device drivers during the installation process.
Signed drivers.
Because drivers run with an elevated system-level privilege, they are able to
access anything on the computer. For this reason, it is important to be able to trust
the device drivers that are installed.
Trust involves two main principles:
1. Authenticity the software package is genuinely from the claimed source
2. Integrity the software package is complete, intact, and has not been modified
after its release.

ExamForce.com 70-680 Study Guide

18

Digital signatures allow administrators and end users who are installing Windows-based
software to know that a legitimate publisher has provided the software package. The 64-bit
version of Windows 7 requires that all device drivers be digitally signed.
To verify the driver's signature, we can use the sigverif.exe tool. This tool allows us to check
if unsigned device drivers are in the system area of the computer. This tool also produces a log
file for later inspection. To remove an unsigned device driver, follow these steps:
1. Execute the sigverif.exe tool to scan for unsigned drivers.
2. Review the resulting log file.
3. Create a temporary folder to store any detected unsigned drivers.
4. Manually move any unsigned drivers from the systemroot\System32\Drivers folder into the
temporary folder.
5. Disable or uninstall the associated hardware device.
6. Restart the computer.
Conflicts between drivers.
Sometimes, the installation of a new device driver will conflict with an existing driver. When
this happens, well see either a red X or a yellow triangular caution sign with an exclamation
mark next to the device drivers in conflict.
To correct this, we must either update or uninstall the device drivers in conflict. To update the
device driver, right-click on the device and click Update Driver Software, as follows:

Configuring driver settings.

Driver settings can be configured by opening the Device Manager, locating the specific device,
right-clicking and selecting Properties. Then, select the Driver tab. From here, you can view
details about the driver, update the driver, roll the driver back, disable the driver, and uninstall
the driver.

ExamForce.com 70-680 Study Guide

19

Resolving problem device driver.

Windows 7 provides multiple ways of resolving problems with device drivers, including:
1. Driver Roll Back If your computer can successfully start, either normally or in Safe
Mode, then this will be an option for resolving driver issues. To roll back a driver, follow
this procedure:
a. Restart the computer into Safe Mode by hitting the F8 key during reboot
b. Log in and open the Device Manager
c. Right-click the device to rollback and click Properties
d. Click the Drivers tab and then click the Roll Back Driver button
e. Click Yes in the dialog box
f. Complete the roll back wizard
2. Last Known Good Configuration this option is made possible by the storage of startuprelated configuration information stored in the HKLM\SYSTEM hive of the Registry. In
here, there are a series of Control Sets, including CurrentControlSet and
LastKnownGood. When you make a change to the computer, the change is stored in the
CurrentControlSet key. When you restart the computer and successfully log on, Windows
synchronizes the CurrentControlSet and LastKnownGood keys.
To use the Last Known Good Configuration option, press the F8 key during bootup and
select it from the list of available options.
3. System Restore In more rare and extreme cases, the installation of new device drivers can
cause the computer to not boot up properly. In this case, you are not able to roll a driver
back because this is executed from within the OS. It is recommended to try the Last

ExamForce.com 70-680 Study Guide

20

Known Good Configuration first, but if this fails, youll have to use the System Restore.
Luckily, a System Restore is reversible because an undo restore point is created during the
process.
System Restore can be accessed from either Safe Mode or the Windows RE (Recovery
Environment) during bootup.

Configure application compatibility.

Setting compatibility mode.
An application written for a specific operating system can cause problems when installed on a
computer with a different operating system. To troubleshoot and address the problems
effectively, it is important to be aware of the general areas that typically cause the most
compatibility issues. These areas include the following:
1. 64-bit versus 32-bit architecture
2. OS version changes
3. Internet Explorer protected mode
4. User Account Control
5. Kernel-mode drivers
To set compatibility mode, complete the following procedure:
1. Right-click on a programs shortcut, .exe file, or installation program.
2. Click on Properties
3. Click on the Compatibility tab

4. Check the Run this program in compatibility mode for box and select the Operating
System (as seen above).

ExamForce.com 70-680 Study Guide

21

5. Check or uncheck boxes as needed in the Settings to disable any settings that are not
compatible with your current OS.
6. If you need to change the Privilege Level for all users accessing this application, check the
Run this program as an administrator box under the Privilege Level section.
7. Click the OK button
Implementing shims.
A shim is a software program, added to an existing application or other program to provide
enhancement or stability. This is also called a compatibility fix.
The Compatibility Administrator Tool, which is installed with ACT (Application Compatibility
Toolkit), is used to create new shims. This tool has preloaded many common applications,
including known compatibility fixes, compatibility modes, or application help messages.
Before you can create a new compatibility fix, you must search the Compatibility Administrator
Tool for an existing application and then copy and paste the known fixes into your customized
database.
To create a new shim:
1. In the left pane of the Compatibility Administrator, under the Custom Databases heading,
right-click the name of the database to which you will apply the compatibility fix. Click
Create New, and then click Application Fix. The Create new Application Fix
Wizard will appear.
2. In the wizard, do the following:
a. Type the name of the application to which this compatibility fix will apply
b. Type the name of the application vendor
c. Browse to the location of the application executable file
d. Click the Next button
3. Select the OS for which your compatibility fix applies, click any applicable compatibility
modes to apply to the fix, and then click Next.
4. Select any additional compatibility fixes to apply and then click Next.
5. Select any additional criteria to use to match your applications to the AppHelp message,
and then click Finish.
6. Save the compatibility fix as a compatibility fix database (.sdb file).
To implement the newly-created shim:
1. Store your compatibility fix database (.sdb file) in a location from which all computers can
access it (locally, network share, etc).
2. After deploying and storing the .sdb file on each computer, you must register the .sdb file.
To do this, use the Sdbinst.exe command-line tool to install the custom compatibility fix
database locally on the computer.
Compatibility issues with Internet Explorer.
Websites that were designed for earlier versions of Internet Explorer might not display correctly
in the current version of IE version 8 included in Windows 7. To help alleviate this, we can turn
on the Internet Explorer Compatibility View feature. When you turn on Compatibility View, the

ExamForce.com 70-680 Study Guide

22

webpage you're viewing, as well as any other webpages within the website's domain, will be
displayed as if you were using an earlier version of Internet Explorer.

Configure application restrictions.

Setting software restriction policies.
You can use the Local Group Policy Editor to configure the settings on a standalone workstation
that is running Windows 7. To configure local Group Policy, run gpedit.msc from the Search box
with elevated privileges.
AppLocker reduces administrative overhead and helps administrators control how users access
and use files, such as .exe files, scripts, Windows Installer files (.msi and .msp files), and .dll
files.
AppLocker can help organizations that want to:
1. Limit the number and type of files that are allowed to run by preventing unlicensed or
malicious software from running and by restricting the ActiveX controls that are installed.
2. Reduce the total cost of ownership by ensuring that workstations are homogeneous across
their enterprise and that users are running only the software and applications that are approved
by the enterprise.
3. Reduce the possibility of information leaks from unauthorized software.
Setting through group policy or local security policy.
AppLocker is an MMC snap-in in the Group Policy Object Editor consisting of two wizards. One
wizard allows you to create a single rule, and another automatically generates rules based on rule
preferences and the selected folder.
To access AppLocker, click Start and type Gpedit.msc. Then navigate to Computer
Configuration, Windows Settings, Security Settings, and then Application Control Policies.
Expand the Application Control Policies node and highlight AppLocker.
Below is a screenshot of the Group Policy Editor after navigating to the AppLocker:

ExamForce.com 70-680 Study Guide

23

Configure Internet Explorer.

Configuring compatibility view.
Because many web pages were built in previous versions of Internet Explorer, this feature helps
display web pages with older settings if they cannot display properly in the newest version of IE.
Compatibility View can be turned on via the following methods:
1. Through the Address Bar If Internet Explorer detects that a website is not compatible, it
will display the
click this button.

icon in the URL address bar. To turn on Compatibility View, simply

2. Through the Tools Menu Compatibility View can also be turned on via the Tools menu
option by select the Compatibility View option.
3. Through the Compatibility Views Settings Also under the Tools menu of Internet
Explorer is the Compatibility View Settings option. This will let you turn on or off
Compatibility View for a web page by adding or removing the web page address from the
Compatibility View list.

ExamForce.com 70-680 Study Guide

24

Configuring security settings.

Windows 7s Internet Explorer provides the ability to apply security settings under the Internet
Options, which is located under the Tools menu, as seen below:

Managing add-ons.
There are two ways you can find & install add-ons in Internet Explorer 8: you can browse
directly to the Internet Explorer Add-ons Gallery page or you can click on the Tools -> Manage
Add-ons menu option.

ExamForce.com 70-680 Study Guide

25

Controlling InPrivate mode.

Security is always a concern for business environments, so Internet Explorer provides a way to
help users maintain their security and privacy with InPrivate browsing and filtering. InPrivate
Browsing helps protect data and privacy by preventing browsing history, temporary Internet
files, form data, cookies, usernames, and passwords from being stored or retained locally by the
browser.
InPrivate Filtering is designed to monitor the frequency of all third-party content as it appears
across all Web sites visited by the user.

ExamForce.com 70-680 Study Guide

26

You can also set the following features under Tools -> Internet Options -> Privacy Tab:

Configuring SmartScreen Filtering.

With the sharp rise in online attacks, such as Phishing attacks, Internet Explorer 8 offers a way
for businesses to protect their assets and resources. IE 8 builds on current Phishing Filtering
technology that was introduced in IE version 7 and helps protect against malicious or deceptive
sites that would attempt to perform extortion or identity theft.
The SmartScreen Filter relies on a Web service that is backed by a Microsoft-hosted URL
reputation database. The filters analysis of this database works alongside of other security
technologies, such as Malicious Software Removal Tool, Windows Live OneCare, and Windows
Defender to provide a robust suite of tools designed to protect the user.
By default, the SmartScreen Filter is enabled in the Internet, Trusted, and Restricted Zones, but
disabled in the Intranet Zone, since it is a more secure zone, by nature. To add web sites to the
Trusted Zone list and turn off SmartScreen for this zone:
1. Go to Tools -> Internet Options
2. Click on the Security tab
3. Click on the Trusted Sites icon and then click Sites
4. In the Add this website to the zone dialog box, enter the web site URL and click Add
5. Close the dialog box
6. On the Security tab, click Custom Level, and then under Use SmartScreen Filter, select
Disable
7. Click OK

ExamForce.com 70-680 Study Guide

27

Certificates for secure Web sites

A public key certificate, usually just called a certificate, is a digitally signed statement that binds
the value of a public key to the identity of the person, device, or service that holds the
corresponding private key.
One of the main benefits of certificates is that hosts no longer have to maintain a set of
passwords for individual subjects who need to be authenticated as a prerequisite to access.
Instead, the host merely establishes trust in a certificate issuer.
To import a new certificate, go to the Tools -> Internet Options -> Content tab and go to the
Certificates section:

ExamForce.com 70-680 Study Guide

28

Next, click on the Certificates button and click the Import button. This will open the Certificate
Import Wizard:

Simply complete the wizard to import a new security certificate.

ExamForce.com 70-680 Study Guide

Chapter 4 Configuring Network

Connectivity
Configure IPv4 network settings.
Connecting to a network.
To connect to an IPv4 network, you must configure an IP address, subnet mask, and
default gateway. To do this:
1. Click Start -> Control Panel -> Network and Internet
2. Click View Network Status and Tasks
3. In Network and Sharing Center, click Change adapter settings on the left side
of the window
4. Right-click on the network adapter and click Properties
5. Double-click Internet Protocol Version 4 (TCP/IPv4)
6. Either leave default setting to pull IP information from a DHCP server (requires
separate setup), or click the Use the following address radio button and type
in the IP address, Subnet mask, and Default Gateway.

29

Chapter

Quick Jump To:

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

Configuring name resolution.

If configuring IP addressing information statically, youll also need to type in a valid
DNS server IP address, as shown above. Additionally, you can click on the
Advanced tab to enter or modify additional DNS information.

ExamForce.com 70-680 Study Guide

30

Setting up a connection for a network.

To setup a connection to an IPv4 network, follow this procedure:
1. Click Start -> Control Panel -> Network and Internet
2. Click View Network Status and Tasks
3. In Network and Sharing Center, click Setup a new connection or network in the middle
of the window
4. Under the Choose a connection option window, choose one of the following four options
and complete the appropriate wizard:

ExamForce.com 70-680 Study Guide

31

Resolving connectivity issues.

To troubleshoot and resolve connectivity issues:
1. Click Start -> Control Panel -> Network and Internet
2. Click View Network Status and Tasks
3. In Network and Sharing Center, click Troubleshoot problems at the bottom of the
window
4. Under the Troubleshoot problems Network and Internet window, select one of the
following options and complete the wizard:

APIPA
APIPA stands for Automatic Private IP Addressing, and allows DHCP clients to automatically
self-configure an IP address and subnet mask when a DHCP server isn't available.
If the client is unable to find the information, it uses APIPA to automatically configure itself
with an IP address from a range that has been reserved especially for Microsoft. The IP address
range is 169.254.0.1 through 169.254.255.254. The client also configures itself with a default
class B subnet mask of 255.255.0.0. A client uses the self-configured IP address until a DHCP
server becomes available.
Configure IPv6 network settings.
Connecting to a network.
To connect to an IPv6 network, you must configure an IP address, subnet mask, and default
gateway. To do this:
1. Click Start -> Control Panel -> Network and Internet
2. Click View Network Status and Tasks

ExamForce.com 70-680 Study Guide

32

3. In Network and Sharing Center, click Change adapter settings on the left side of the
window
4. Right-click on the network adapter and click Properties
5. Double-click Internet Protocol Version 6 (TCP/IPv6)
6. Either leave default setting to pull IP information from a DHCP server (requires separate
setup), or click the Use the following address radio button and type in the IP address,
Subnet mask, and Default Gateway.

Configuring name resolution.

If configuring IP addressing information statically, youll also need to type in a valid DNS server
IP address, as shown above. Additionally, you can click on the Advanced tab to enter or modify
additional DNS information.
Setting up a connection for a network.
To setup a connection to an IPv6 network, follow this procedure:
1. Click Start -> Control Panel -> Network and Internet
2. Click View Network Status and Tasks
3. In Network and Sharing Center, click Setup a new connection or network in the middle
of the window
4. Under the Choose a connection option window, choose one of the following four options
and complete the appropriate wizard:

ExamForce.com 70-680 Study Guide

Resolving connectivity issues.

To troubleshoot and resolve connectivity issues:
1. Click Start -> Control Panel -> Network and Internet
2. Click View Network Status and Tasks
3. In Network and Sharing Center, click Troubleshoot problems at the bottom of the
window
4. Under the Troubleshoot problems Network and Internet window, select one of the
following options and complete the wizard:

33

ExamForce.com 70-680 Study Guide

34

Link local multicast name resolution.

Included in Windows 7 is the Link Local Multicast Name Resolution (or LLMNR) and is a
protocol based on the DNS packet format that allows IPv6 hosts to perform name resolution for
hosts on the same local link.
In responding to queries, responders listen on UDP port 5355 on the following IPv6 link-scope
Multicast address: FF02:0:0:0:0:0:1:3 (can be abbreviated as FF02::1:3).

Configure networking settings.

Adding a physically connected (wired) or wireless device.
Just like previous versions, Windows 7 supports Plug-and-Play devices, so any modern wired or
wireless network card will be supported by this feature. Using Plug-and-Play, just turn the
computer off, install the network interface card (NIC), and turn the computer back on. After
logging in, Windows 7 will detect the new device and search for the device drivers. If it can't
find the drivers, it will then prompt you for the location, such as a CD/DVD.
To manually add a wired or wireless NIC, go to the Control Panel Hardware and Sound
Devices and Printers page and click the Add a device link. This will pop up a dialog box that
will search for available devices to add. From here, you can select a device from the list, or state
that it is not in the list and search for it yourself.
Connecting to a wireless network.
To connect to a wireless network, either allow Windows 7 to automatically detect the available
SSIDs and click on the desired network, or go to the Network and Sharing Center and click on
the Set up a new connection or network link. From here, click on the Connect to the Internet
wizard and follow the instructions presented.

ExamForce.com 70-680 Study Guide

35

Configuring security settings on the client.

You can set additional security settings via the Advanced sharing settings section of the
Network and Sharing Center. By clicking on this link, you'll be given the option of turning on or
off the following options:
1. Network discovery
2. File and printer sharing
3. Public folder sharing
4. Media streaming
5. Number of file sharing connections
6. Password-protected sharing
7. Number of Homegroup connections
Set preferred wireless networks.
The following settings configure how the Windows 7 client connects to a wireless network.
1. Connect automatically when this network is in range the computer will try to connect to
this particular wireless network whenever it is in range.
2. Connect to a more preferred network if available -- if this is selected, when there are multiple
wireless networks in range, the computer will try to connect to one of the others instead of this
particular wireless network.
3. Connect even if the network is not broadcasting its name (SSID): select this if the wireless
AP is configured to not advertise its SSID.
Configuring network adapters.
To configure your computer's Network Interface Card (NIC), click on the Change adapter
settings link in the Network and Sharing Center. Then, right-click the appropriate NIC and
select Properties, as follows:

Configuring location-aware printing.

Windows 7 offers the ability to automatically switch your laptops default printer when it detects
you have moved from one network location to another, such as from public to domain. This

ExamForce.com 70-680 Study Guide

36

feature, called location-aware printing, is only found on laptops and other portable devices that
use a battery.
Once the default printer is set for your computer, you must then perform the following steps to
manage the location-aware printing settings:
1. In Devices and Printers, click Manage default printers on the toolbar.
2. In the Manage Default Printers dialog box, click Change my default printer when I change
networks.
3. Click the Select network list, and then choose a network.
4. Click the Select printer list, select a corresponding default network printer, and then click
Add.

Configure Windows Firewall.

Configuring rules for multiple profiles.
Windows Firewall is a host-based, stateful firewall included in Windows 7. It drops incoming
traffic that does not correspond to traffic sent in response to a request (solicited traffic) or
unsolicited traffic that has been specified as allowed (accepted traffic).
Multiple active firewall policies enable computers to obtain and apply domain firewall profile
information regardless the networks that are active on the computers.
Using the Advanced Settings link in the Windows Firewall configuration page, you can manage
multiple profiles, as shown below:

ExamForce.com 70-680 Study Guide

37

Allowing or denying an application.

Rules are a collection of criteria that define which traffic you will allow, block, or secure with
the firewall. You can configure different types of rules:
1. Inbound rules explicitly allow or block traffic that matches criteria in the rule. For example,
if you want to run a Web server, then you must create a rule that allows unsolicited inbound
network traffic on TCP port 80.
2. Outbound rules explicitly allow or deny traffic originating from the computer that matches
the criteria in the rule. For example, you can configure a rule to explicitly block outbound traffic
to a computer (by IP address) through the firewall, but allow the same traffic for other
computers.
3. Connection Security Rules secure traffic by using Ipsec while it crosses the network. You use
connection security rules to specify that connections between two computers must be
authenticated or encrypted.
To create a rule based on an application, select whether it will be incoming or outgoing and click
the New Rule option on the right side of the window. Then, ensure that the Program option
is selected. You'll then provide the path to the selected application and complete the wizard.
Network-profile-specific rules.
Just like above, you'll first determine which direction the new firewall rule will be applied
(incoming or outgoing), and then you'll click the New Rule link on the right-hand side of the
window. Then, ensure that the Port or Custom options are selected, as follows:

ExamForce.com 70-680 Study Guide

38

Configuring notifications.
To change notification settings within the Windows 7 Firewall, access the Windows Firewall and
click on the Change Notification Settings link on the left side of the window. Here, you can
set notification preferences for both private and public networks, as follows:

Configuring authenticated exceptions.

To allow exceptions within the Windows 7 Firewall, access the Windows Firewall and click on
the Allow a Program or Feature through Windows Firewall link on the left side of the window.
Then, you'll be able to check a box next to the application and select whether to allow it through
your private and/or public networks.

ExamForce.com 70-680 Study Guide

39

Configure remote management.

Remote management methods.
Windows 7 provides the following remote management methods:
1. Remote Desktop This tool enables users to connect to their desktop computer from
another device. It also enables administrators to connect to multiple remote servers at a
time.
2. Remote Assistance This feature enables a user to request that a remote friend or support
technician connect to their desktop computer. It also allows for the option of giving the
remote support technician control of the desktop.
With this tool, assistance can be requested or offered. Windows Remote Assistance
sessions require password authentication. In addition, Windows Remote Assistance
sessions are secured and encrypted.
3. DirectAccess This is a new feature to Windows 7 and Windows Server 2008 R2, which
provides users the experience of being seamlessly connected to their corporate network any
time they have Internet access.
With DirectAccess enabled, requests for corporate resources (such as e-mail servers, shared
folders, or intranet Web sites) are securely directed to the corporate network, without
requiring users to connect to a virtual private network (VPN).
4. BranchCache This is a new feature of Microsoft Windows 7 designed specifically for
businesses that operate from multiple office locations. As its name suggests, BranchCache
provides a file caching service for professional network administrators to use at their

ExamForce.com 70-680 Study Guide

40

branch offices. This service works by enabling Windows servers to automatically retrieve
and distribute local copies of files being accessed remotely by Windows 7 clients.
Configuring remote management tools.
1. Remote Desktop Must be configured on both the remote and host computers.
a. Host Computer
i. Launch the Remote Desktop Connection
ii. Click on the General tab and enter the following:
1. Logon username and password
2. Preferred display settings
3. Configure local resources such as clipboard and printer access
4. Specify programs you want to start when connected to the remote
computer
5. Choose the connection speed (determines level of visual options
youll have)
6. Provide any security credentials required for the connection
iii. Save settings by clicking the Save button on the General tab.
iv. Click Connect to connect to the remote computer.
b. Remote Computer
i. In the Control Panel, click System and Security
ii. Then, click System -> Remote Settings
iii. In the Remote tab, select one of the following options:
1. Dont allow connections to this computer
2. Allow connections from computers running any version of Remote
Desktop. This is a less secure option.
3. Allow connections only from computers running Remote Desktop
with Network Level Authentication. This is a more secure option.
2. Remote Assistance Remote assistance requires two actions: the local user requests
assistance and the remote support personnel responds and provides assistance. Lets look
at both steps individually:
a. Requesting User:
i. User clicks Start and types in the Search box remote assistance
ii. User clicks Windows Remote Assistance that appears in the Programs list
iii. In the Windows Remote Assistance wizard, the user clicks Invite someone
you trust to help you

ExamForce.com 70-680 Study Guide

41

iv. The user will then send either by email application or saving the file, if using
web-based email

v. The user will now setup a password for the guest user. Please note that the
password will not be included in the email invitation, so the user will
manually send the password to the invitee.

vi. Windows 7 will draft the email to be sent:

1. Hi, I need help with my computer. Would you please use Windows
Remote Assistance to connect to my computer so you can help me?
After you connect, you can view my screen and we can chat online.
To accept this invitation, double-click the file attached to this
message. (If you are running Windows Vista, you can also save the
file to a location on your computer. Then you can open Remote
Assistance, click Offer to help someone, and then open this file.)
Thanks. Note: Do not accept this invitation unless you know and
trust the person who sent it.

ExamForce.com 70-680 Study Guide

42

vii. The user will keep the request open until the remote support personnel
connect:

b. Supporting Technician:
i. Open email application to retrieve request email.
ii. Type the password configured by the requesting user

Note: This password is not sent in the email, so the user will have to deliver
it by some other means.
iii. The support personnel will now be able to request remote control of the
users desktop and provide the needed assistance.
3. DirectAccess Configuration of DirectAccess requires the following:
a. One or more Windows Server 2008 R2 servers with dual NICs
b. One or more Domain Controllers and DNS servers running Windows Server 2008
or Windows Server 2008 R2
c. A Public Key Infrastructure (PKI)
d. IPSec policies
e. IPv6 transition technologies (dual-stacking, 6to4, ISATAP, etc.) if your network is
not fully able to support IPv6 currently
f. Windows 7 Enterprise installed on client computers

ExamForce.com 70-680 Study Guide

43

4. BranchCache BranchCache requires both client-side and server-side configuration, as

follows:
a. On the Windows 7 client:
i. Turn on BranchCache
ii. Enable either the Distributed Cache mode or Hosted Cache mode
iii. Configure the client firewall to enable BranchCache protocols
iv.
b. On the Windows 2008 R2 Server:
i. Not installed by default, so must be installed
ii. Configure BranchCache manually or with Group Policy
c. Network Requirements:
i. Supports Secure Socket Layer (SSL) that is available thru HTTPS and IPv6
IPSec.
Executing PowerShell commands
Windows PowerShell is a powerful task-based command-line tool that enables administrators to
automate many types of tasks, thus, being more productive. This tools provides not only a GUI
scripting editor, but large repositories of pre-built scripts are also available for download.
Based on the .NET Framework, it uses built-in commands called cmdlets. Powershell has the
following system and feature requirements:
1. Windows PowerShell requires Microsoft .NET Framework 2.0
2. Windows PowerShell ISE requires Microsoft .NET Framework 3.5 with Service Pack 1
3. The Out-GridView cmdlet requires Microsoft .NET Framework 3.5 with Service Pack 1
4. The Get-WinEvent cmdlet requires Windows Vista or later version and Microsoft .NET
Framework 3.5
5. The Export-Counter cmdlet only runs on Windows 7
6. Many cmdlets require Administrative-level privileges to function properly
To get help for PowerShell cmdlets:
1. get-help <cmdlet-name> -detailed
a. This command will give you a detailed helpfile for the selected cmdlet, including
the proper syntax, descriptions of any relevant parameters, and an example that
demonstrates the cmdlets use.
2. get-help about_commonparameters
a. All cmdlets support parameters that are common among all cmdlets that provide a
consistent interface within PowerShell.
The current version of PowerShell is version 2.0 and is fully backward-compatible with version
1.0. Older cmdlets and scripts do not require modification to work on the newer version.

ExamForce.com 70-680 Study Guide

Chapter 5 Configuring Access to

Resources
Configure shared resources.
Folder virtualization.
In some instances, applications can be run using virtualization tools. Microsoft
offers several tools know as Microsoft Virtual PC, Microsoft Virtual Server,
Microsoft Application Virtualization (App-V) and Microsoft Enterprise Desktop
Virtualization (MED-V). There are many advantages to using virtualization.
1. It provides the ability to support a large number of servers in a single
environment
2. It provides the ability to easily restore a virtual configuration to a
previous working state.
3. App-V allows the administrator to implement applications without
having to install the software on the clients machine. The client uses
the application in a virtual bubble so that it does not affect any other
applications that are running on the machine.
4. Med-V creates a virtual machine on the clients computer and the
applications are accessed from within the virtual machine.
Keep in mind that performance issues and lack of support for hardware-specific
drivers are limiting for full production.
Shared folder permissions.
Shared folder permissions allows user to access shared resources from different
locations within the network. There are 4 ways that Windows 7 allows you to share
folder permissions.
1. The Microsoft Management Console - MMC Snap-in titled Shares
2. Windows Explorer
3. Command Line
4. Computer Management
The Microsoft Management Console (MMC)
The MMC snap-in titled shares allows the administrator to manage all file
shares on a centrally located computer. To set up the MMC, use the following steps:
5. Start in the Start Search box, type mmc Enter
6. Continue if UAC prompt appears.
7. Once you are in the MMC File Add/Remove Snap-in
8. Select Shares snap-in dialog box and choose the computer the snap-in
needs to access and click Finish
9. Click OK again
10. Return to the MMC Shared Folders Share. The existing shared
folders and files will be displayed.

44

Chapter

Quick Jump To:

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

ExamForce.com 70-680 Study Guide

45

11. Select Action New Share. This starts the Create a Shared Folder Wizard and
click Next.
12. The Folder Path page will be displayed. Enter the path to the folder to share or
click Browse and choose the path from the folder or add a new one and click Next.
13. Enter a description and click Next.
14. Select the permissions that are needed for users in the Shared Folder Permissions
page.
15. Select Finish on the Shared Folder Permissions page and Finish again to close the
wizard.
Windows Explorer
1. Open Windows Explorer and right click on the folder that needs to be shared. An
option will appear Share with. Select Nobody or Specific people.
2. Choose the people on the network that need to access the Folder. This is on the
Choose people on your network to share with page. Select Everyone to choose all
listed people or select Find to choose specific people and click Share and Done.
Command Line
1. Start All Programs Accessories Right click on the Command Prompt
option and choose Run as Administrator.
2. Type net share <sharename=drive:path>
Computer Management
1. Start Control Panel All Control Panel Items Administrative Tools
Computer Management System Tools Shares
2. From the menu bar, select Action New Share OR select the Share a Folder from
the toolbar.
3. The Create a Shared Folder Wizard will open. Follow the Shared Folder Wizard
steps.
Printers and queues.
It is important to understand the printing components of Windows 7. Defining the Printer Port
and Installing a Driver as well as sharing a network printer will be discussed. The installation of
these devices is very similar to installing and using printers in the most common versions of
Windows. This section will review the Installation and Sharing of a Printer as well as ways to
manage and view the Print Queues.
Defining the Printer Port
Windows 7 can automatically find the printers once they are connected to your computer and it
will (by default) install the needed drivers that are found in the driver store. If you are installing
a printer that uses a serial or parallel port, you may need to install the printer manually.
Installing a Driver
Print drivers are needed so that your computer will communicate to the printer. These drivers
are often preloaded onto your Windows machine and can often be found on a CD that comes
with your printer. A printer setup wizard can be used to find your printer and install all drivers

ExamForce.com 70-680 Study Guide

46

that are needed. The printers manufacturers website is another good resource in obtaining the
print drivers.
Installing a Printer
This example will show the steps to install a printer through the Devices and Printers page as
well as sharing a printer and setting advanced options.
1. Start Control Panel View devices or printers Add a printer
2. The Add Printer wizard will open a new dialogue box. Select the Add a local printer
option.
3. In the Choose a printer port page - Use an existing port list LPT1: (Printer
Port) Next. (Note: This example uses LPT1: if another port is being used, select the
available port from the port list.)
4. From the Install the printer driver page, select the printer brand in the Manufacturer
list and the printer model in the Printers list and click Next.
5. Choose Next on the Type a printer name page and on the Print Sharing page accept all
defaults and select Next Finish.
Set Permissions
1. In Devices and Printers, right click on the printer you just installed and choose the Print
Properties from the menu
2. Security Tab Add
3. Select Users, Computers, Service Accounts or Groups box and in the Enter the
object names to select (examples) box, type the group name, select Check Names
OK
4. In Group or user names box, select the group name you just setup.
5. In the Permissions for IT box, select Manage this printer and click Allow. Also select
Manage documents and click Allow and then select Apply.
6. Select the Advanced tab and the Hold mismatched documents box.
7. Select General Location (type in the Location) Preferences Quality Option
Best Photo OK OK to close the box.
8. OK again will close the Printer box.
Printing Queues
Printing Queues allow the administrator or users the ability to view, pause and cancel print jobs.
This also displays information such as what is currently print or waiting to print as well as the
job status, who is printing and what they are printing and the number of unprinted pages that are
left to print. There are two ways to view this information. The first is by using the See whats
printing option in Devices and Printers control panel page and the second is by using the Print
Management MMC snap-in.
See whats printing
1. In Control Panel, select Hardware and Sound Devices and Printers.
2. In the notification area, select your printer and click the See whats printing option.
OR
1. Double-click the printer icon in the notification area.

ExamForce.com 70-680 Study Guide

47

From this location, you can begin to manage your print queues.
1. To cancel a single print job, right click on the print job you want to cancel and click
Cancel.
2. To cancel all print jobs, select Printer menu Cancel All Documents.
3. To pause a single print job, right click on the print job you want to cancel and click
Pause.
4. To pause all print jobs, select Printer menu Pause Printing. To later continue the
printing jobs, select Pause Printing again.
5. Restart a print job by right-clicking the print job and selecting Restart.
6. Reorder the print queue by right-clicking the print job you wish to reorder and click
Properties. Select the General tab and drag the Priority tab left or right to rearrange the
print order.
Configuring HomeGroup settings
Windows 7 offers the HomeGroup feature for users in very small networks. By using online
IDs and Windows user account information, data can be shared between a small group of
computers. This is done securely using the PKU2U protocol in Windows 7 and the Security
Support Provider (SSP) in the Windows Server 2008 R2. The HomeGroup configurations
options can be found in the Network and Sharing Center. When setting up computers to be a
part of the HomeGroup, you must modify the Basic Firewall settings in the Network and Sharing
Center so that the computer is set to the Home or work (private) networks. HomeGroup
computers cannot be part of the Domain Networks or the Public Networks.
Configure file and folder access.
Encrypting files and folders by using EFS.
EFS stands for Encrypting File System. EFS is a built-in encryption tool Windows 7 and is a
part of the NTFS file system. It is also very important to extensively research EFS so that you

ExamForce.com 70-680 Study Guide

48

can ensure your users data is not harmed or exposed. The EFS tool has several basic facts that
you must understand before installation.
1. EFS happens at the file-system level NOT at the application level. This allows the
encryption and decryption process to be transparent to the users and to the
application.
2. The user must have the key in order to open a file. If the user does not have the key,
they will receive an Access Denied error.
3. The encryption uses symmetric keys that are encrypted with the users public key and
stored in a file header. There is also a private key (asymmetric key) that is also stored
in the users profile. Both the public and private key are needed in order to access the
files. These keys are tied to the users ID and password. There are two ways to
obtain the key pairs. One being from a Certificate Authority (CA). The CA allows
all of the keys to be managed and backed up. The second is by allowing the user to
self generate the keys. This option poses risks due to there being no centralized
management and the users are in control of managing and backing up their own keys.
However, there is no setup or major expense involved.
4. In the event the private key is damaged or missing, no files can be decrypted. You
have to have a recovery agent and/or a key archival system in order to recover the key
so that the files can be decrypted. If you have neither of these components, the users
file could be lost. It is important that the users certificate that contains the private
keys be kept in a separate location such as a CD or floppy disk.
5. Another important fact to understand about the public and private keys is that they are
protected by the users password. If another user guesses or obtains the user
password, they will have the ability to decrypt the files. Ensure that all passwords
adhere to a strong password policy and user education on the best security practices
for your company.
6. EFS encrypted files are in plaintext when being moved across the network. If the
Folder or location they are moved to is encrypted, the files will be encrypted locally.
If it is needed that the files remain encrypted when moving across the network, they
will need to be saved to a Web folder using WebDAV.
7. EFS can only be used on the NTFS file system. If users move the file to a non-NTFS
file system, the file will not be encrypted.
Configuring NTFS permissions.
NTFS permissions allows one to secure files based on permissions. Permissions include Read,
Write, Deny, and Full Control.
1. Right click on the file you choose to grant permissions. Select Properties Security
Edit.
2. Find the Permissions for Deliverables box Add.
3. Choose the Enter the object names to select (examples) box and Select Users,
computers, Service Accounts, or Groups.
4. Click Check Names and OK
5. Select the user or group from the Group or user names box.
6. Select Write or Deny and then OK.
7. Windows Security box Yes and then Deliverable Properties OK

ExamForce.com 70-680 Study Guide

NOTE:

49

Using this process you can also verify the NTFS

permissions of the users, computers, groups or service
accounts.

Resolving effective permissions issues.

It is very important to understand the priority of the Effective Permissions. Effective
Permissions are the combination of the user and group permissions for all files and folders.
Windows 7 Effective Permissions have the following features:
1. Has the ability to determine and display the permissions that have been granted to a user
or group
2. Identifies all of the domains and local groups that the user is a allowed access
3. Recognizes the account permissions that have been obtained for the parent file or folder
It is also important to know that all Deny permissions take precedence over any other allowed
permissions.
The Effective Permissions can be viewed on files and/or folders by using the following steps:
1. In Windows Explorer, locate the file or folder that you wish to view the effective
permissions.
2. Right click on the file/folder and select Properties Security tab Advanced
Effective Permissions Select.
3. Type the name of the user or of the group in the Enter the object name to select
(examples) and then select OK. The effective permissions of the user or of the group for
that specific file or folder will be determined by the selected check boxes.
Example 1:
Group 1 has Modify permission to a folder. User 1 that is a member of Group 1 has denied
Modify permissions for the folder. What is the effective permission?
Answer: The user is denied the modify permission. Remember that all Deny permissions take
precedence over any other permissions.
Example 2:
There are 2 groups for this example. Users group which has Write permissions to Folder 1 and a
Sales Group that has Read permission to Folder 1. User 1 is a member of both groups. What
permission does the user have for Folder 1?
Answer: Write and Read permission because User1 is a member of both groups.
Copying files vs. moving files
Copying and moving files or folders may have various impacts on the current permissions. It is
imperative to understand the impacts of copying vs. moving the files. Listed below are the
impacts.

ExamForce.com 70-680 Study Guide

Within Same NTFS

Partition
Different NTFS
Partition
Non-NTFS Partition

NOTE:

NOTE:

Copy Files
Inherits permission of destination
folder
Inherits permission of destination
folder
Loses the NTFS permissions

50

Move Files
Inherits permissions of new parent folder
Inherits permission of destination folder
Loses the NTFS permissions

In order to copy files or folders within NTFS partitions,

you have to have at least Read permission for the source
folder and Write permission for the destination folder.

In order to move files or folders within or between NTFS

partitions, you have to have Write permission for the
destination folder and Modify permission for the source
file or folder. Windows 7 will delete the file or folder
from the source after it is copied.

Configure user account control (UAC).

Configuring local security policy.
Computers that are members of an Active Directory domain receive security configurations
through the Group Policy Object Editor. GPO allows the following security settings to be
defined. Password Policies, Account Lockout Policy, Audit Policy, User Rights Assignments,
Security Options, Windows Firewall with Advanced Security, Network List Manager Policies,
Public Key Policies, Software Restriction Policies, IP Security Policies, Windows Updates, Disk
Quotas, and Driver Installations. Once you have set configurations for all of the security-related
settings, export them to a policy file and save them with a .INF extension in a security template
fie. The security template can be imported to the Local Group Policy Editor and used for
additional PCs.

Configuring admin vs. standard UAC prompt behaviors.

There are two types of User Account Control that can be setup and supported in the Windows 7
Operating System. Standard Users and Administrative Users.
Standard Users have the following capabilities within Windows 7:
1. Install Windows updates
2. Install Windows driver updates
3. View all Windows settings.
4. Install Bluetooth devices
5. Run Network Diagnostic and Repair functions as well as reset network adapters.
Administrative Users have the following capabilities within Windows 7:
1. Read/Write/Execute permissions
2. All Windows functions and privileges.

ExamForce.com 70-680 Study Guide

51

Configuring Secure Desktop

Configuring Secure Desktop requires access to the Group Policy Object settings. Within the
GPO Setting: User Account Control: Behavior of the elevation prompt for administrators in
Admin Approval Mode, and User Account Control: Switch to the secure desktop when
prompting for elevation.
Configure authentication and authorization.
Resolving authentication issues.
Authentication is used to verify a users identity. This is typically accomplished by username
and password. In environments that need additional security, such as banking institution and
financial transactions, digital certificates are issued and verified by a Certification Authority.
Authorization identifies what the authenticated user has the right to access. Authorization
includes permissions to files, directory access, amount and hours of access.
Configuring rights.
Each file or folder can be granted or denied permissions.
To grant permissions:
1. Right-click on the file/folder that you will be granting permission to and select
Properties.
2. Click on the Security tab Edit Permissions Add
3. Select Users, Computers, Service Accounts, or Groups box under the Enter the object
names to select (Examples), type the users directory\name select Check Names
OK.
4. In Group or user names, select the username
5. Permissions for box, next to Write, select Allow OK OK
To deny permissions:
1. Right-click on the file/folder that you will be granting permission to and select
Properties.
2. Click on the Security tab Edit Permissions Add
3. Select Users, Computers, Service Accounts, or Groups box under the Enter the object
names to select (Examples), type the users directory\name select Check Names
OK.
4. In Group or user names, select the username
5. Permissions for box, next to Modify, select Deny OK OK
Managing certificates.
Within the Certificate Manager MMC, there are options to export certificates and private keys.
All certificates can be found in the Personal Certificate store.
Smart cards with PIV.
Smart cards with Personal Identity Verification can be used as another level of security. PIV is
an industry standard as defined by the National Institute of Standards and Technology. When the
Smart card with PIV is installed, Windows will automatically download the updated drivers.
Windows 7 has a mini-driver included in the event the updated environment is not available.

ExamForce.com 70-680 Study Guide

52

Elevating user privileges.

User Account Control (UAC) provides a way for each user to elevate his or her status from a
standard user account to an administrator account without logging off, switching users, or using
Run as. Windows 7 includes changes that enhance the user experience, increase user control of
the prompting experience, and increase security.
There are two general types of user groups in Windows 7: standard users and administrative
users. UAC simplifies users ability to run as standard users and perform their necessary daily
tasks. Administrative users also benefit from UAC because administrative privileges are
available only after UAC requests permission from the user for that instance.
To modify User Account Control (UAC) settings, click the Start button and type User Account
Control. Select the option that says Change User Account Control Settings. This window will
give you a sliding bar that will allow you to adjust the sensitivity of when you are prompted for
administrative privileges.

Multifactor authentication
Multifactor authentication is an additional layer of security that has been added to Windows 7.
This includes items such as smart card authentication and additional PIN or startup keys.
Configure BranchCache.
Distributed cache mode vs. hosted mode.
BranchCache offers many advantages especially in todays growing environments.
BranchCache provides the capability to store content locally. For example, if a large file needs
to be viewed from a corporate office, the file will be cached locally so that others that view it
will experience less download times. This will reduce WAN utilization, optimize traffic flows
between clients and servers, support common network protocols, support end to end encryption
and compatibility and it remains transparent to the users. There are two different types of
BranchCache Distributed Cache and Hosted Cache.

ExamForce.com 70-680 Study Guide

53

Distributed Cache is basically shared across client computers. The information is cached in the
first requesting client computer and is shared with the other users that access the same file. This
is helpful for branch locations that do not have local servers.
Hosted Cache is information that is stored on a server that is located at the branch office. All
client computers retrieve the information from the local server. The local server must be a
Windows Server 2008 R2. Because of the client/server architecture that the Hosted Cache
provides, the advantages include the fact that it works across subnets and reduces multicast
traffic.
Network infrastructure requirements.
There are two main requirements for BranchCache Hosted Environment. One PC must run
Windows Server 2008 R2. This server is required to be located at the main server location or at
the branch office location. The second requirement is that all client PCs must run Windows 7
Enterprise.
Configuring settings.
The following instructions will provide step by step for setting up BranchCache on a client
Machine.
1. Click Start Computer Local Disk (C:)
2. Select New Folder and type BranchCache Enter
3. Right Click on BranchCache Folder and select Properties Sharing tab Advanced
Sharing.
4. Select Share this folder check box Permissions Remove Add
5. In the dialog box Select Users, Computers, Service Accounts, or Groups and in the
Enter the object names to select (examples) field, type authenticated users and click
Check Names OK
6. Return to the Permissions for Authenticated Users tab, click Allow check box that is
listed next to Full Control OK
7. Return to Advanced Sharing and select Caching. Select Enable BranchCache OK
8. Permissions for Authenticated Users tab, click Allow check box that is listed next to
Full Control OK
9. Return to Advanced Sharing and select Caching. Select Enable BranchCache box and
click OK
10. Advanced Sharing OK
11. Select BranchCache Properties Security tab Edit Add
12. In the dialog box Select Users, Computers, Service Accounts, or Groups and in the
Enter the object names to select (examples) field, type authenticated users and click
Check Names OK
13. Return to the Permissions for Authenticated Users tab, click Allow check box that is
listed next to Full Control OK
14. BranchCache Properties Close
Certificate management.
Within the Certificate Manager MMC, there are options to export certificates and private keys.
All certificates can be found in the Personal Certificate store.

ExamForce.com 70-680 Study Guide

Chapter 6 Configuring Mobile

Computing
Configure BitLocker and BitLocker To Go.
Configuring BitLocker and BitLocker To Go policies.
BitLocker Drive Encryption protects the computer operating system and the data that
is stored within the operating system volume. It provides off line data protection and
also provides protection for the applications that are installed in the encrypted
volume. The BitLocker Drive Encryption also uses a Trusted Platform Module
(TPM) to provide system integrity verification of all boot components and boot
configuration data that happens during the startup process.
There are a few requirements that are needed in order to properly implement
Bitlocker Encryption.
1. The PC must have Trusted Platform Module (TPM) v1.2 or later
2. A removable USB memory device
3. The PC must have available hard drive space to create 2 partitions. One
volume will be the system volume and the second will be the operating
system volume.
4. The BIOS must be compatible with TPM and support USB devices during PC
startup.
The following steps will be needed to install BitLocker:
1. Open Windows Explorer.
2. Right click the volume to be encrypted and select Turn On BitLocker
3. A startup wizard will begin that verifies and validates the system
requirements, creates the 2nd partition, and presents the options to access an
encrypted drive such as USB, User Function keys for the passphrase, or select
no key.
BitLocker To Go protects all of the data and information that is stored on any
external device such as USB and external hard drives. BitLocker To Go Drive
Encryption is very easy to implement.
1. Open Windows Explorer
2. Right click the external device to be encrypted and select Turn On BitLocker
3. Select one of three options that will allow the encrypted drive to be unlocked:
Unlock with a recovery password/passphrase, a smart card, or auto-unlock
the external device when it is connected to a specific PC.
Managing the Trusted Platform Module (TPM).
BitLocker offers two modes of operation: TPM Mode and Non-TPM mode.
TPM Mode locks the boot up process of the computer until the user enters a personal
PIN and/or connects a USB drive that has been programmed with a BitLocker key.
It also verifies the system integrity on all boot components. The TPM version must
also be 1.2x. The TPM is a hardware component that is installed on newer computer

54

Chapter

Quick Jump To:

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

ExamForce.com 70-680 Study Guide

55

systems. When a computer starts the boot process, the BIOS, boot sector and the boot manager
code are examined and a hash value is calculated and stored in the TPM. This value stays in the
TPM until the system is rebooted. At this point, these values can be used to create a key that is
tied to the value stored in the TPM module. Only that specific TPM can decrypt the value.
In Non-TPM Mode, a Group Policy is setup specifically to allow BitLocker to work without a
TPM. In this scenario, the BitLocker startup key is only configured and stored on the USB drive
and provides very limited authentication.
Data Recovery Agent support
DRA or Data Recovery Agent Support provides users and administrators the ability to recover
any data from the BitLocker and BitLocker To Go devices that have data that has become
inaccessible. The DRA is a key protector that allows IT admins to be able to access the
encrypted and protected volumes.
Configure DirectAccess.
Configuring client side; configuring authentication.
Direct Access is only offered in Windows 7 and Windows Server 2008 R2. This is a new feature
that is offered and provides remote users with access to internal network resources just by being
connected to the Internet. Direct Access does not use VPN Services. It allows authorized users
on Windows 7 computers access to corporate shares, intranet web sites and applications. There
are several additional security features that are offered.
1. Multifactor Authentication Methods (i.e. Smart cards)
2. IPv6
3. Encryption methods such as DES and 3DES
4. Network Access Protection (NAP) which performs checks on client computers before
they are allowed to connect to internal resources.
5. DirectAccess servers can be set up to specify the servers, users and applications that are
allowed to be accessed.
DirectAccess works on a client/server scenario. An IPSec session is established between the
server and the client however, it is not used across the internal network. Very similar to a VPN
deployment without all of the extra time it takes to establish the VPN connection and get
authenticated. For the highest level of security, Microsoft recommends deploying IPv6 and
IPSec. In addition, all application servers should be running Windows Server 2008 R2. The IT
Administrators should also be selective in the server access. This will allow authentication from
end-to-end between the DirectAccess client to the internal resources that have been defined as
usable.
From the client side, the following process is used for the connection:
1. The DirectAccess computer runs Windows7 determines that there is a connection to the
network.
2. The DirectAccess computer tries to establish a connection to a pre-defined Intranet
website that was configured during the DirectAccess configuration.
3. The DirectAccess computer connects using IPv6 and IPSec.
4. The connection uses a SSL connection to establish connectivity.
5. For the IPSec session, the client/server scenarios use computer certificates for
authentication.

ExamForce.com 70-680 Study Guide

56

6. The DirectAccess server authenticates the computer and user based on the valid AD
group memberships.
Network infrastructure requirements.
Direct Access has several requirements to be successful.
1. The server must be running Windows Server 2008 R2 with 2 network adapters.
2. One DNS and one domain controller running Windows Server 2008 or Windows Server
2008 R2
3. PKI Public Key Infrastructure
4. IPsec policies
5. IPv6 transition technologies (ISATAP,6to4, Teredo)
6. Windows 7 Enterprise on the client computers
7. A NAT-PT device to provide IPv4 access (this is optional)
Configure mobility options.
Configuring offline file policies.
Windows 7 has several caching options that will allow systems and files to be available offline.
WIM allows the administrator to service an image offline. DISM (Deployment Image Servicing
and Management) is a too that is also used to service and manage the Windows images.
Transparent caching.
Windows 7 introduces a new feature for Offline Files & Folders called Transparent Caching.
Prior to Windows 7, to open a file across a slow network, client computers always retrieved the
file from the server, even if the client computer had recently read the file. With Windows 7
transparent caching, client computers cache remote files more aggressively, reducing the number
of times a client computer might have to retrieve the same data from a server.
With transparent caching, the first time a user opens a file in a shared folder, Windows 7 reads
the file from the server and then stores it in a cache on the computers hard disk drive. The
second and subsequent times a user reads the same file, Windows 7 retrieves the cached file from
disk instead of reading it from the server. To provide data integrity, Windows 7 always contacts
the server to ensure the cached copy is up-to-date. The cache is never accessed if the server is
unavailable and updates to the file are always written directly to the server.
Transparent Caching is done by caching reads to remote files over a slow network in the Offline
Files (CSC) cache. Subsequent reads to the same file are then satisfied from the client (cache)
after verifying the integrity of the cached copy, leading to improved end-user response times
and decreased bandwidth consumption over the WAN links to the server.
However, the cached files are temporary and are not available to the user when offline. Also, the
cached files are not kept in sync with the version on the server and the most current version from
the server is always available for subsequent reads.
Transparent Caching is not enabled by default and can be enabled through Group Policy.

ExamForce.com 70-680 Study Guide

57

Configure remote connections.

Establishing VPN connections and authentication.
In a Windows7 environment, any VPN connections must connect back to a Windows Server
2008. The following steps enable an administrator to establish a VPN connection.
1. Control Panel Network and Internet Network and Sharing Center Set up a
new connection or wizard Connect to a Workplace.
2. You will be prompted with Do you want to use a connection that you already have?
Select if you would like to establish a new connection or select an existing connection.
3. Next choose Use my Internet Connection (VPN). Now you will be prompted to choose
your VPN connection or to enter an Internet Address and Destination Name for the
VPN Server. You may also choose to use:
i. Smart card for authentication
ii. Allow other people to use this connection
iii. Dont connect now, just set up so I can connect later
Enabling a VPN reconnect.
VPN reconnect is a service offered that allows the VPN connection to automatically reconnect if
the users Internet connection is lost. VPN Reconnect uses IKE v2.
Advanced security auditing.
Security auditing can be used to test drivers and applications before deployment. Once you
restart the computer in audit mode, changes can be made and tested before they are sent to end
users. Security Audit Policies can be put into place so that you can view logon events, user
account control settings and shutdown.
NAP quarantine remediation.
Network Access Protection (NAP) performs compliance checks before they connect to internal
networks or resources.
Remote desktop.
Remote desktop is supported as a Windows 7 feature that allows administrators and users to
connect to a desktop computer and servers from another device.

ExamForce.com 70-680 Study Guide

58

Chapter 7 Monitoring and Maintaining

Systems that Run Windows 7

Chapter

Quick Jump To:

Configure updates to Windows 7.

Configuring update settings.
The Windows Update page allows you to change the settings regarding how the
updates will be installed, allows you to view the update history and restore any
hidden updates.
Determining source of updates.
There are 3 ways to configure the Windows Update:
1. The Windows 7 default and recommended setting is to download and install
all updates automatically at 3 am. In the event the users PC is turned off, the
updates will download and install when the PC is turned on.
2. In most corporate environments, administrators use a WSUS (Windows
Server Update Services) Server.
3. For larger systems, a SCCM (System Center Configuration Manager) is used.
This system is customized to schedule the patch delivery methods.
Configuring Windows Update policies.
Windows Update is a Windows 7 feature that ensures software updates and drivers
remain at the most current level. These automatic updates are additions or changes
to current software that help prevent or fix issues. Often these updates will improve
and enhance your computers performance.
Reviewing update history.
This section or page allows you to review all patches that have been downloaded and
installed. It also shows the status of the installations so that you can ensure all
patches have been received successfully.
Checking for new updates.
The Windows update page allows you to determine how you check for the new
updates in the Change Settings feature.
1. As recommended, Install the updates automatically.
2. Download updates but let me choose whether to install them
3. Check for updates but let me choose whether to download and install them.
Rolling back updates.
Rolling back updates is found in the Restore Hidden Updates Page.

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

ExamForce.com 70-680 Study Guide

59

Manage disks.
Managing disk volumes.
There are 2 tools that are offered in Windows 7 Operating System that allows you to manage
disks and volumes: the MMC Disk Management Snap-in and the DiskPart.exe command-line
interface tool.
Disk Management
Disk Management Snap-In is part of the Microsoft Management Console (MMC). This snap-in
is a GUI that allows you to manage basic and dynamic discs and volume on any computer. It
also allows for simple partition creation. This tool can be used on computers that are local or
remotely located. The Windows 7 enhancements include simpler partition creation, Disk
conversion options as well as the ability to extend and shrink partitions. To open Disk
Management, click Start and in the search box type diskmgmt.msc and click on diskmgmt.msc
in the result list.
Diskpart.exe
Diskpart.exe can be run from the command line and allows you to create scripts to automate
tasks. Diskpart.exe runs locally. To access Diskpart, type diskpart at a command prompt. At
the diskpart> prompt, you can begin to configure diskpart. To view a list of commands, type
commands at the diskpart> prompt. To run scripts, create your script as a text file and type the
following command as the diskpart> prompt: diskpart /s testscript.txt. You can also create and
display a log file of your script by typing diskpart /s testscript.txt > logfile.txt.
Managing file system fragmentation.
Disk fragmentation is the continual storage of data. The Windows I/O manager saves these files
in contiguous areas. Over time the users will save, change, and delete files and begin to fill up
the hard drives and the contiguous area becomes harder to locate. New files that are installed
will sometimes have to use some of the non-contiguous space. This can lead to performance
problems on the computer.
Defragmenting a volume basically rearranges fragmented files and data so the computer can
work more efficiently. To defragment a drive:
1. Open Windows Explorer and right click the volume to defragment
2. Click Properties Tools tab Defragment Now
You can also perform tasks such as disabling automatic fragmentation, modify the fragmentation
schedule, select the volumes that need to be defragmented, analyze the disks to determine which
ones need to be defragmented or manually defragment a disk.
RAID.
RAID Redundant array of independent disks is also often referred to as a striped volume.
Striped volumes combine unallocated space from multiple disks. This improves the I/O
performance and provides higher throughput by distributing I/O across all of the disks that are
configured as part of the set.
The most common types of RAID configurations are shown below:
1. RAID-0: RAID-0 is called disk "striping". All the data is spread out in chunks across all
the disks in the RAID set. RAID-0 has great performance, because you spread out the

ExamForce.com 70-680 Study Guide

60

load of storing data onto more physical drives. There is no parity generated for RAID-0.
Therefore there is no overhead to write data to RAID-0 disks. RAID-0 is only good for
better performance, and not for high availability, since parity is not generated for RAID-0
disks. RAID-0 requires at least two physical disks.
2. RAID-1: RAID-1 is called disk mirroring. All the data is written to at least two separate
physical disks. The disks are essentially mirror images of each other. If one of the disks
fails, the other can be used to retrieve data. Disk mirroring is good for very fast read
operations. It's slower when writing to the disks, since the data needs to be written twice.
RAID-1 requires at least two physical disks.
3. RAID 1+0: RAID 1+0, which is also called RAID-10, uses a combination of disk
mirroring and disk striping. The data is normally mirrored first and then striped.
Mirroring striped sets accomplishes the same task, but is less fault tolerant than striping
mirror sets. If you lose a drive in a stripe set, all access to data must be from the other
stripe set, because stripe sets have no parity. RAID 0+1 requires a minimum of four
physical disks.
4. RAID-5: RAID-5 uses disk striping with parity. The data is striped across all the disks in
the RAID set, along with the parity information needed to reconstruct the data in case of
disk failure. RAID-5 is the most common method used, since it achieves a good balance
between performance and availability. RAID-5 requires at least three physical disks.

Monitor systems.
Configuring event logging.
Event logs record major events and errors that occur on computer systems. To view or
troubleshoot any errors in Windows 7, you use the Event Viewer. The Event Viewer grants
access to the following event logs: Application, Security, Setup, and System.
Filtering event logs.
The event logs can be found under the Windows Logs node. Select the log, select the event and
a preview pain under that event list will provide the details of the event. As an example, if you
were looking for network problems such as IP conflicts, you would look in the System log for
errors or warnings that pertain to the network services.
Data collector sets.
Data Collector Sets are customized performance counters, event traces and system configs.
These Data Collector Sets can be used to optimize to the performance monitoring and allows the
administrator to generate alerts when the counters or traces reach certain thresholds.
Generating a system diagnostics report.
Windows 7 has a built-in Windows Diagnostic Infrastructure (WDI). The WDI can help solve
issues with Memory failures, Network Issues, and Startup problems.
1. Memory failures could pertain to issues such as application failures, operating system
faults and stop errors.
2. Network issues included items such as interface not being properly configured, IP
addressing configuration errors, and hardware failures to name a few.

ExamForce.com 70-680 Study Guide

61

3. Startup problems include memory malfunctions, design flaws, corrupted device drivers,
startup files, and disk data.
Configure performance settings.
Configuring page files.
Paging files work bested in Striped drive volumes. To enhance the performance of a volume,
one entire volume should only contain the PAGEFILE.SYS file. By doing this, the
PAGEFILE.SYS is less likely to become fragmented and it will improve performance of the
computer. It is not required to have a redundant paging file. Paging file activity is write
intensive which makes it more suitable for striped volumes as opposed to RAID 5 volumes that
are better suited for read performances.
Configuring hard drive cache.
Disk Write Caching is a feature which allows you to increase the performance of your Hard
Disk. While this can improve performance, it comes attached with its own risk. If the system or
disk loses power then there is every possibility that the data gets corrupted or lost in the event of
a power failure. Depending upon the criticality of the data and the reliability of the power and
power backups and UPS, enabling or disabling Disk Write Caching should be enabled or
disabled.

By default, disk write caching is enabled in Windows 7, but can be modified by navigating to the
Device Manager, expanding the disk drives, selecting the appropriate hard drive, right-clicking
and selecting Properties. Then, choose the Policies tab and either check or uncheck the boxes
for the two options shown above.
Updated drivers.
Dynamic Update and Windows Update work together to ensure all critical fixes and drivers are
downloaded during the setup process. Dynamic Update is a feature within the Windows 7 Setup.

ExamForce.com 70-680 Study Guide

62

In the event that updated device drivers are not found in the Windows Update section, you can
find the latest drivers by:
1. The computer manufacturers website for updated drivers.
2. The hardware manufacturers website.
3. Search the web using the driver device name.
To manually search for updates:
1. In Device Manager, double-click the device you want updated
2. Right-click the device and click Update Driver Software and follow the wizard.
Configuring power plans.
There are 3 different power plans that are offered in Windows 7 Operating System.
1. Power Saver conserves power by reducing system performance in order to maximize
battery life.
2. High Performance makes adjustments to processor speeds based on your work or
activities.
3. Balanced Provides a balance between energy consumption and system performance by
making the necessary adjustments to the processor speed of your activity.

By default, the High Performance plan is hidden, as it is the most intensive of the three plans.
Configuring desktop environment.
The desktop environment in Windows 7 can be modified by right-clicking anywhere on the
desktop and selecting Personalize. From this window, you can modify the background image,
screen savers, color schemes, etc. as follows:

ExamForce.com 70-680 Study Guide

Configuring services and programs to resolve performance issues.

Performance issues can be resolved by using Data Collector Sets and Performance Monitor.
To access the Performance Monitor, use the following steps:
1. Click Start find the search box and type per click Performance Monitor and click
the Performance Monitor node. By default, only the %Processor Time is shown.
This location will allow you to add all of the Data Collector Sets, Performance Monitor, and
Resource Monitors.

63

ExamForce.com 70-680 Study Guide

64

Chapter 8 Configuring Backup and

Recovery Options

Chapter

Quick Jump To:

Configure backup.
Creating a system recovery disk.
A system recovery disk is used to boot the entire computer in the event there is a
serious error. To create a system recovery disk, go to Control Panel and select the
Backup and Restore Tool
Backing up files, folders, or full system.
To backup files, folders or full system, click on the Control Panel and select the
Backup and Restore Tool.
1. Start All Programs Maintenance Backup and Restore Set up
backup
2. Click Allfiles Next Let me choose Next.
3. By default, the libraries and system image is checked. Remove all checked
boxes and select the bolded Administrators Libraries box Next.
4. Change schedule. Confirm the Run backup on a schedule (recommended)
box is checked and select the options that are required for corporate policies
such as How often, What day, and What time click OK
5. Now Save Settings and Run Backup. You can click View Details to see
the progress. Once completed, close the Backup and Restore.
Scheduling backups.
1. Start All Programs Maintenance Backup and Restore Set up
backup
2. Click Allfiles Next Let me choose Next.
3. By default, the libraries and system image is checked. Remove all checked
boxes and select the bolded Administrators Libraries box Next.
4. Change schedule. Confirm the Run backup on a schedule (recommended)
box is checked and select the options that are required for corporate policies
such as How often, What day, and What time click OK
5. Now Save Settings and Run Backup. You can click View Details to see
the progress. Once completed, close the Backup and Restore.
Configure system recovery options.
Configuring system restore points.
System Restore allows the user to restore all system files in the event of a failure or
catastrophic event within your computer. System Restore houses a feature known as
System Protection. This system creates and saves restore points weekly or when
System Restore detects a change to your computer system. A change being the
installation of new drivers, applications or programs that will affect any system files.
System Restore points can also be created manually. Components that are captured
during the System Restore are registry, Dllcache folder, user profiles, COM+ and

Chapter 1

Chapter 2

Chapter 3

Chapter 4

Chapter 5

Chapter 6

Chapter 7

Chapter 8

ExamForce.com 70-680 Study Guide

65

WMI info, IIS metabase and some monitored system files. System Restore should not be used to
backup personal files.
In order to run System Restore from Windows 7, follow these steps:
1. Start Computer Properties in the System Window System Protection
Protection settings click Local Disk (C:) (System) Configure
2. In the Restore Settings Restore system settings and previous versions of files
OK
3. In the Protection settings Allfiles (drive:) Configure
4. In the System Properties Create. This step is often done automatically as mentioned
above. However, it can be set manually.
5. In the System Protection Restore Point 1 Create. When completed -> Close.
6. Click OK in the System Properties window and Close.
Restoring system settings.
To restore the system settings to Restore Point 1 as mentioned above, follow the next steps:
1. Start All Programs Accessories, System Tools System Restore
2. The window will be Restore system files and settings
3. Click Next
4. Select Restore Point 1 Next
5. Confirm your restore point Finish
6. Yes to continue
7. Close
Last known good configuration.
Since Microsoft Windows NT versions, there has been a Last known good configuration option.
The Last know good configuration option is a way of going back to a previous state of a working
operating system. In Windows 7, the registry database stores the startup and device
configuration.
The majority of the information can be found in the HKLM\SYSTEM hive. Two control sets
CurrentControlSet and LastKnownGood are stored in this registry hive. The LastKnownGood
control set can be found in HKLM\SYSTEM\Select node. Any device change is stored in the
CurrentControlSet and is saved here once the computer is rebooted and logged onto successfully.
At this point, windows will sync the CurrentControlSet and the LastKnownGood control sets. In
the event of a failure, the two control sets will not be synchronized.
To revert to the LastKnownGood Configuration, reboot the computer but do not logon. During
the boot sequence press F8 and access the Advanced Boot Options menu. Select
LastKnownGoodConfiguration(advanced).
Driver rollback.
In the event of a device driver update failure, the Windows 7 operating system offers the option
of Driver rollback. Driver rollback can be found by the following these steps:
1. Start right click Computer Manage Device Manager

ExamForce.com 70-680 Study Guide

66

2. From this point you will select the device that the driver was just updated. Right click the
device and select Properties select the Driver tab
3. You will see Roll Back Driver click Yes Close
4. In the System Settings Change window, select Yes to restart the computer.

Configure file recovery options.

Configuring file restore points.
File restore points are created one time per day. System Protection has to be turned on for each
partition and drive that is created. To create the restore point, right click the file or folder System
Protection tab and click Create.
Restoring previous versions of files and folders.
In order to restore files and folders, use the Backup and Restore feature in Windows 7. To
restore, follow these steps:
1. Start All Programs Maintenance Backup and Restore
2. Click Restore my files Browse for files
3. Locate the files to restore, double-click Documents Important Document Add
files then Next In the original location Restore
4. If the file already exists, click Copy and Replace Finish
There are instances where you may wish to save the files in a different location. A copy of an
older version may be needed for comparison. You must keep both versions of the file to get the
new information that was added or deleted.
Restoring damaged or deleted files by using shadow copies.
Shadow Copies are created 3 times. They are created when a restore point is established, on a
scheduled basis as defined or when the file changes. This provides system and application
consistency. Note that System Protection should be turned on. If it is enabled, Windows
automatically creates the previous versions of the files and folders from the last restore point. In
most cases, restore points are created once per day. Make sure that if you have partitioned disks,
that System Protection is enabled for both or all partitions.